useful.inc

这是脱壳 PE-ARMOR 的程序源代码汇编的

@pushsz	macro	string
	local	__1
	call	__1
	db	string,0
__1:
endm

@copysz		macro
	        local   nxtchr
	nxtchr: lodsb
	        stosb
	        or      al,al
	        jnz     nxtchr
endm

@endsz  	macro
	        local   nxtchr
	nxtchr: lodsb
	        test    al,al
	        jnz     nxtchr
endm

PUSHAD_EDI		EQU	00h
PUSHAD_ESI		EQU	04h
PUSHAD_EBP		EQU	08h
PUSHAD_ESP		EQU	0Ch			; ESP BEFORE PUSHAD
PUSHAD_EBX		EQU	10h
PUSHAD_EDX		EQU	14h
PUSHAD_ECX		EQU	18h
PUSHAD_EAX		EQU	1Ch

rep_movsb	macro
	push	ecx
	shr	ecx, 2
	rep	movsd
	pop	ecx
	and	ecx, 3h
	rep	movsb
endm
rep_stosb	macro
	push	ecx
	shr	ecx, 2
	rep	stosd
	pop	ecx
	and	ecx, 3h
	rep	stosb
endm

m2m			macro	p1, p2
			push	p2
			pop	p1
			endm